A decade ago, I was working at GBS AG and got handed a task that had nothing to do with my actual job: set up SPF and DKIM for a secondary domain. Our tech team was slammed. They didn't have the bandwidth. So they did what busy tech teams do when someone insists — they gave me access and said, essentially, good luck.
I had a technical guide open in one tab and pure stubbornness in the other. No background in DNS. No real understanding of what a TXT record was supposed to do. It took about three hours — the kind of frustrating where you're not sure if the thing you just did worked, and you won't know until you run a check, and the check comes back wrong.
But here's the part that actually matters: that was the day I started paying real attention to outbound. Not because SPF records are inherently fascinating — they are not — but because I'd just learned, the hard way, that the stuff nobody wants to touch is exactly the stuff that determines whether anything else works. You can write the best cold email in the world. If the record behind it is misconfigured, it never leaves the outbox in any way that matters.
clients we onboard have never configured SPF, DKIM, or DMARC.
Not "configured them wrong." Never touched them. The domain has been sending business email for years, nobody thought about authentication because nothing catastrophic happened — and it stayed that way until we showed up and asked to see the DNS.
The pattern I see with almost every new client
Some of them don't even know how to look. I've had calls where I'm asking a founder to check their MX records and there's a long pause, followed by "how do I find that." Not because they're not sharp — some of the founders I work with are the sharpest people in the room on their product. It's because DNS configuration was never anyone's job. It fell into the crack between "the developer set it up years ago" and "marketing runs outbound now," and nobody owns it.
The honest part: DMARC's absence rarely broke a campaign
In our own campaign history, not having DMARC configured has almost never directly produced a bad outcome. I can't point to a specific campaign and say "this failed because DMARC was missing." SPF and DKIM do the heavier lifting for day-to-day deliverability. DMARC's job is more about what it tells inbox providers to do when SPF or DKIM checks fail — and if those two are solid, DMARC often sits quietly in the background not doing much visible work.
So why do we still set it up on every client, every time? Because DMARC is also the record that protects you from domain spoofing — someone else sending email that looks like it's from your domain. We've never watched it happen to a client. We're also not willing to be the case study that proves it can. It's prevention against something we haven't seen fail, applied because the cost of being wrong is disproportionate to the fifteen-minute cost of setting it up correctly.
Why this has to happen before warmup, not during
The sequencing matters more than most people realise.
Warmup is the process of building your domain's sending reputation from zero. Every email your warmed-up inboxes send during that four-to-six-week window is a data point that inbox providers use to decide whether your domain is trustworthy.
The setup, step by step
This is the part I wish someone had handed me in a five-minute conversation instead of a three-hour solo struggle with a technical guide.
- 1 Log into your DNS provider — GoDaddy, Namecheap, Cloudflare, wherever your domain is hosted
- 2 Add a TXT record for your sending domain
-
3
Include the sending platform you're using — Instantly, Smartlead, and others will give you the exact
include:value - 4 You should have exactly one SPF record per domain — multiple SPF records will break authentication, not strengthen it
- 1 Your sending platform generates the DKIM record for you — you don't write this one manually
- 2 Copy the exact value they give you into your DNS as a TXT record
- 3 Double-check for trailing spaces or truncated values — this is the single most common point of failure, and it looks identical to "working" until you actually verify it
-
1
Start with
p=none— this monitors failures without blocking or quarantining anything, the safe starting point -
2
Add a
ruatag with an email address so you actually receive the reports — skipping this means DMARC is running blind -
3
Example record:
v=DMARC1; p=none; rua=mailto:you@yourdomain.com -
4
As your domain matures, you can graduate to
p=quarantineand eventuallyp=reject— most clients running dedicated cold outreach domains never need to go pastp=none
- 1 MX records determine where incoming mail for your domain actually goes
- 2 If you're setting up a dedicated sending domain for cold outreach, make sure MX is configured so replies actually land somewhere you'll see them
- 3 A beautifully authenticated domain that swallows every reply defeats the entire point of cold outreach
Nobody skips this out of laziness. They skip it because it feels like a technical detour on the way to the part they actually care about.
But the founders who skip it are the ones who, six weeks later, are asking why open rates are stuck at 8% despite a genuinely good list and genuinely good copy. The infrastructure was never given a chance to earn trust with inbox providers, because it was never speaking clearly to begin with.
The fifteen minutes it takes to do this properly is the cheapest insurance in your entire outbound stack. Everything downstream — your list quality, your personalisation, your sequencing — only gets to matter if the email actually lands somewhere a human will read it.
Key takeaways
- 9 out of 10 clients we onboard have never configured SPF, DKIM, or DMARC — this is closer to normal than exceptional
- DMARC's absence has rarely caused a direct campaign failure in our experience — but we configure it anyway as protection against domain spoofing
- Get authentication right before warmup starts, not during — fixing it midway resets the trust curve you're trying to build
- SPF: one record only, include value from your sending platform, verified through MXToolbox
- DKIM: copy the platform-generated value exactly — watch for trailing spaces, the most common failure point
- DMARC: start at p=none with an rua reporting address; graduate later only if needed
- Check MX records too — a well-authenticated domain that can't receive replies still fails the actual goal
- MXToolbox verifies all of this for free in about two minutes — use it before sending anything
